CVE-2021-36723 - Emuse - eServices / eNvoice Exposure Of Private Personal Information

Back Back to CVE browser

HIGH

Emuse - eServices / eNvoice Exposure Of Private Personal Information

Published Dec 29, 2021

7.5

HIGH

CVSS 3.1

EPSS 0.53%

Description

Emuse - eServices / eNvoice Exposure Of Private Personal Information due to lack of identification mechanisms and predictable IDs an attacker can scrape all the files on the service.

Affected products

Vendor Emuse Product eServices / eNvoice Default
n/a
- Version
  Production
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Emuse

eServices / eNvoice

n/a

Version	Status	Constraints
Production	affected	-

Remediation

Vendor solution

The Exposure Of Private Personal Information due to lack of identification mechanisms and predictable IDs vulnerability was fixed by adding securety mechanisms and randomising the IDs.

Weaknesses (2)

CWE-200

Exposure of Sensitive Information

CWE-359